The US State Department’s Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national charged in a nine-count federal indictment over hacking operations tied to the HAFNIUM group. The reward was announced on October 8.
Zhang remains at large. The indictment, filed in Houston, concerns attacks on US critical infrastructure.
Who Zhang Yu Is and What He Is Charged With
According to the announcement, Zhang is a director at Shanghai Firetech Information Science and Technology. The US government alleges he worked on tasks assigned by the Shanghai State Security Bureau, which is part of China’s Ministry of State Security.
The alleged hacking period runs from February 2020 to June 2021. The activity included the 2021 Microsoft Exchange Server campaign, in which attackers exploited flaws that Microsoft disclosed on March 2, 2021.
Victims Named in the Allegations
The targets described in the case include US universities, researchers working on COVID-19, and organizations hit through Exchange Server. The Exchange campaign alone affected more than 12,700 US organizations, according to the figures cited.
The Co-Defendant Xu Zewei
A co-defendant, Xu Zewei, was arrested in Milan in July 2025 and extradited to the United States in April 2026. His case shows that the US has succeeded in bringing at least one person charged in the same hacking activity into its courts, while Zhang has not been apprehended.
What the Reward Covers
The Rewards for Justice program offers up to $10 million for information on Zhang. The announcement frames the offer as part of the continuing prosecution. The material available does not set out the specific conditions for receiving the reward.
The charges against Zhang cover the period from February 2020 to June 2021, a span of about sixteen months. Within it, the Exchange Server campaign stands out because Microsoft disclosed the underlying flaws on March 2, 2021, and the intrusions affected over 12,700 US organizations. The indictment’s nine counts relate to attacks on US critical infrastructure, and the earlier targeting of universities and COVID-19 researchers forms part of the same alleged activity.
The 2021 Exchange Server Campaign in Context
The Exchange Server campaign was one of the widest-reaching intrusion operations of 2021 because it exploited flaws in a mail server product used by many organizations. The more than 12,700 US organizations affected underline the scale of that single campaign.
The allegation that Zhang worked on tasks from a state security bureau ties the charges to a state intelligence service rather than to independent criminals. The indictment’s framing treats a private company, Shanghai Firetech, as the structure through which that work was carried out.
Renewed US Pressure on MSS-Linked Contractors
The reward and indictment add to a pattern of US action aimed at contractors that work for Chinese intelligence services. Naming a company director and attaching a seven-figure sum to information about him signals that the government is targeting individuals as well as the groups they are linked to.
The time elapsed is notable. The alleged hacking ended in June 2021, and the reward comes more than five years later, after Xu’s extradition earlier this year. The announcement does not say whether Xu’s case supplied information about Zhang.
Shanghai Firetech Information Science and Technology is the company where Zhang is described as a director. The announcement links the company to tasks assigned by the Shanghai State Security Bureau, and it counts the Exchange Server campaign among the activity covered by the indictment. The case is being brought in Houston, and Zhang’s co-defendant Xu Zewei was extradited to the United States in April 2026.
Zhang remains at large. The indictment itself stands as a public record of the allegations, and the reward offer extends the effort to find him.
